vh/esh-pfi-infrastructure
1
0
Fork 0
Code Issues 7 Pull Requests Actions Packages Projects Releases Wiki Activity

docs(ana-docker): crowdsec sqlite WAL fix for the bouncer fail-closed 403s

Browse Source
This commit is contained in:
vh
2026-10-05 04:19:52 -07:00
parent 241b14bc66
commit 67c72ed228
2 changed files with 3 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
servers/ana-docker/README.md
+1 -1
View File
@@ -40,7 +40,7 @@ General-purpose Docker host for the Anaheim colo. Runs everything at `10.250.0.0
| Stack | Port(s) | Notes |
|-------|---------|-------|
| traefik | 80 / 443 / 8380 | Reverse proxy + TLS (cert resolver `anaprod`) |
| crowdsec (+ blocklist-mirror) | 41412 | IPS; bouncer runs as a Traefik plugin |
| crowdsec (+ blocklist-mirror) | 41412 | IPS; bouncer runs as a Traefik plugin. ⚠ The bouncer FAILS CLOSED: if LAPI does not answer, every public route returns 403. SQLite runs with `use_wal: true` since 2026-10-05. Before that, blocklist-mirror's stream reads held the DB for 26–58 s and caused three public 403 blips (0310/0342/0415); WAL took it to 0.04–2.4 s. Config: `/opt/docker/conf/crowdsec/config.yaml` on the host, not in `stacks/` |
| gitea | 3000 / 222 | Git hosting — `gitea.phasefinal.com` |
| vaultwarden | 9080 | Password vault — `vaultwarden.phasefinal.com` |
| synapse (+ synapse-db, element-web) | internal | Matrix homeserver — `matrix.phasefinal.com`, client at `chat.phasefinal.com` |